zbalance_ipc and Zeek

Zeek
1

Hi All,

Does anyone have a success story using zbalance_ipc and Zeek. We are getting very high packet loss using zbalance_ipc. When we remove zbalance_ipc, Zeek performs well on pf_ring zero copy with RSS. Any advice is appreciated.

R,
CB

2

Hi Colin,

Can you please clarify your deployment ? (node.cfg file, NIC type, PF_RING version, zbalance_ipc parameters and the ingress line rate )

Thanks
B

3

I tried it long ago and got it working correctly. One thing you may need to keep in mind is that if a single one of your workers dies or is restarted, you need to shut them all down and possibly even restart zbalance_ipc and then bring up all of the workers again. I don't know if this is still the behavior of pf_ring anymore but it was at one point.

   .Seth